SOC People, Process, and Technologies SCE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A SOC team is defining its incident response workflow. They want to ensure that every incident is properly documented, tracked, and resolved in a timely manner. Which process should they establish?

   • AAn email distribution list for incident reporting.
   • BA policy that all incidents must be resolved within 24 hours.
   • CA shared spreadsheet for manual tracking.
   • DA ticketing system with defined priority levels and SLA targets.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A SOC has all the latest security technologies, but incident response is still slow because team members often duplicate efforts and miss handoff information. Which change would most effectively improve the integration of people, process, and technology?

   • APurchase additional security tools to automate more tasks.
   • BAssign each analyst a separate incident to handle independently.
   • CRequire all communication to occur through email.
   • DImplement a standardized incident response playbook and use a collaboration platform for real-time updates.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A SOC has invested in advanced security tools, but incidents are still not being handled effectively because team members are unsure of their roles and the steps to follow. What is the most likely missing element?

   • AA larger budget for security tools.
   • BAdditional SOC analysts.
   • CMore advanced technology.
   • DDefined processes and role-based training.
   Reveal Solution Discussion Select an answer first
5. 4application · easy

   A SOC wants to detect malicious network traffic patterns that may indicate a command-and-control communication. Which technology is best suited for this task?

   • AVulnerability scanner
   • BNetwork-based IDS/IPS
   • CEDR solution
   • DSIEM system
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In a SOC, what is the primary benefit of having well-defined processes and workflows in place?

   • AThey eliminate the need for human analysts.
   • BThey ensure that every incident is handled in a consistent and repeatable manner.
   • CThey allow the SOC to operate without any technology.
   • DThey guarantee that all threats are automatically blocked before they cause damage.
   Reveal Solution Discussion Select an answer first